Description

SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access the users account information in the application, which could be leveraged to facilitate further attacks against the identified user accounts. This vulnerability results in low impact on confidentiality of the data, with no impact on the integrity and availability

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-11T01:17:22.280Z",
  "pubdate": "2026-08-11T01:17:22.280Z",
  "executiveSummary": "SAP Manufacturing Integration and Intelligence (MII) is affected by an authorization bypass vulnerability that arises from the absence of necessary authorization checks on specific application functions. This security flaw enables a low-privileged authenticated attacker to access sensitive user account information that should otherwise be strictly restricted to privileged administrative users. Successful exploitation of this vulnerability results in a low impact on data confidentiality, while integrity and availability remain completely unaffected. The risk implications primarily involve unauthorized information disclosure, which could potentially be leveraged by an adversary to facilitate subsequent, more advanced attacks against identified user accounts within the application ecosystem. The exploitation requirement dictates that the attacker must possess valid low-privileged authentication credentials to interact with the vulnerable application functions. The affected product is SAP Manufacturing Integration and Intelligence (MII).",
  "technicalDetails": "The root cause of this vulnerability is the failure of the SAP Manufacturing Integration and Intelligence (MII) application to properly enforce access control mechanisms and perform necessary authorization checks on certain application functions. Specifically, the vulnerable component lacks adequate server-side validation to verify whether the requesting user possesses the required privileges before executing sensitive functionality or returning restricted data.\nThe exploitation method relies on an authenticated session belonging to a low-privileged user. Because the underlying application functions do not validate user roles or permissions against the requested resource, an attacker can directly invoke these restricted functions or access specific endpoints without encountering authorization barriers. The attack flow begins with the authenticated low-privileged attacker identifying the target application functions that lack proper access controls. Subsequently, the attacker crafts and sends malicious or direct requests to these functions using their standard session credentials. Upon receiving the request, the vulnerable backend component processes the execution without performing the requisite privilege validation, thereby returning sensitive user account information to the unauthorized entity.\nThe authentication requirement for this attack is a valid low-privileged user account within the application. The privilege requirements are minimal, as the attacker does not need administrative or elevated rights to successfully bypass the flawed authorization checks. Network exposure is inherent to the application interface, typically accessible via HTTP/HTTPS protocols where the application is deployed. The payload behavior involves direct interaction with the unprotected endpoints or functions, retrieving user account details that are improperly exposed. The post-exploitation impact is limited to the unauthorized disclosure of user account information, which compromises confidentiality and provides reconnaissance data that could theoretically be chained or leveraged to facilitate further attacks against specific user accounts, though the vulnerability itself does not grant direct execution or integrity/availability degradation."
}